SECBOOT_KEYS_DIR = $(BINARIES_DIR)/secboot_keys
SECBOOT_SCRIPT_FILE = secboot_script.sh
SECBOOT_SCRIPT = $(SECBOOT_KEYS_DIR)/$(SECBOOT_SCRIPT_FILE)

BL2_SIGN_FILE = bl2-signature.bin
BL2_SIGN = $(ARM_TRUSTED_FIRMWARE_IMG_DIR)/$(BL2_SIGN_FILE)

BL2_BIN_FILE = bl2_w_dtb.bin
BL2_BIN = $(ARM_TRUSTED_FIRMWARE_IMG_DIR)/$(BL2_BIN_FILE)

INSTALL_PATH_SECBOOT_KEYS = $(TARGET_DIR)/etc/keys/secboot/

ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_OPTEE),y)
OP_TEE = 1
else
OP_TEE = 0
endif

####################################################################################
# HSE 的 Key Handle
####################################################################################
# 从配置中获取值使用 := 立即展开
BL2_HANDLE_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_BL2_HANDLE))
BL31_HANDLE_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_BL31_HANDLE))
BL32_HANDLE_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_BL32_HANDLE))
BL33_HANDLE_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_BL33_HANDLE))
# BL2_HANDLE 使用 := 因为它是基础值
BL2_HANDLE := $(if $(BL2_HANDLE_CONFIG),$(BL2_HANDLE_CONFIG),0x010700)
# 其他 Handle 使用 = 延迟展开，因为依赖于 BL2_HANDLE
BL31_HANDLE = $(if $(BL31_HANDLE_CONFIG),$(BL31_HANDLE_CONFIG),$(BL2_HANDLE))
BL32_HANDLE = $(if $(BL32_HANDLE_CONFIG),$(BL32_HANDLE_CONFIG),$(BL2_HANDLE))
BL33_HANDLE = $(if $(BL33_HANDLE_CONFIG),$(BL33_HANDLE_CONFIG),$(BL2_HANDLE))

####################################################################################
# HSE 的 Private Key file
####################################################################################
BL2_PRIVATE_KEY_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_RSA_PRIV_BL2))
BL31_PRIVATE_KEY_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_RSA_PRIV_BL31))
BL32_PRIVATE_KEY_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_RSA_PRIV_BL32))
BL33_PRIVATE_KEY_CONFIG := $(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_S32_HSE_RSA_PRIV_BL33))
RSA_PRIV_BL2_FILE = bl2_rsa2048_private.pem
RSA_DEFAULT_PRIV_BL2 = $(SECBOOT_KEYS_DIR)/$(RSA_PRIV_BL2_FILE)
RSA_PRIV_BL2 := $(if $(BL2_PRIVATE_KEY_CONFIG),$(BL2_PRIVATE_KEY_CONFIG), $(RSA_DEFAULT_PRIV_BL2))
RSA_PRIV_BL31 = $(if $(BL31_PRIVATE_KEY_CONFIG),$(BL31_PRIVATE_KEY_CONFIG),$(RSA_PRIV_BL2))
RSA_PRIV_BL32 = $(if $(BL32_PRIVATE_KEY_CONFIG),$(BL32_PRIVATE_KEY_CONFIG),$(RSA_PRIV_BL2))
RSA_PRIV_BL33 = $(if $(BL33_PRIVATE_KEY_CONFIG),$(BL33_PRIVATE_KEY_CONFIG),$(RSA_PRIV_BL2))
RSA_PRIV_KEYS = \
                 $(RSA_PRIV_BL2) \
                 $(RSA_PRIV_BL31) \
                 $(RSA_PRIV_BL33)

$(shell mkdir -p $(SECBOOT_KEYS_DIR) && openssl genrsa -out $(RSA_DEFAULT_PRIV_BL2) 2048)
####################################################################################
# HSE 的 Public Key file
####################################################################################
RSA_PUB_BL2_FILE = bl2_rsa2048_public.pem
RSA_PUB_BL31_FILE = bl31_rsa2048_public.pem
RSA_PUB_BL32_FILE = bl32_rsa2048_public.pem
RSA_PUB_BL33_FILE = bl33_rsa2048_public.pem
RSA_PUB_BL2 = $(SECBOOT_KEYS_DIR)/$(RSA_PUB_BL2_FILE)
RSA_PUB_BL31 = $(SECBOOT_KEYS_DIR)/$(RSA_PUB_BL31_FILE)
RSA_PUB_BL32 = $(SECBOOT_KEYS_DIR)/$(RSA_PUB_BL32_FILE)
RSA_PUB_BL33 = $(SECBOOT_KEYS_DIR)/$(RSA_PUB_BL33_FILE)
RSA_PUB_KEYS = \
                $(RSA_PUB_BL2) \
                $(RSA_PUB_BL31) \
                $(RSA_PUB_BL33)

####################################################################################
# HSE 的 Private Key file 同步到 secboot_keys 目录中
####################################################################################
define ARM_TRUSTED_FIRMWARE_PREPARE_SECBOOT_BUILD
    @if [ -d "$(SECBOOT_KEYS_DIR)" ]; then \
        echo "SECBOOT_KEYS_DIR exists. Deleting and recreating the directory..."; \
        rm -rf $(SECBOOT_KEYS_DIR); \
    fi
    $(INSTALL) -d $(SECBOOT_KEYS_DIR)

    cp -u $(RSA_PRIV_BL2) $(SECBOOT_KEYS_DIR)/$(notdir $(RSA_PRIV_BL2))
    cp -u $(RSA_PRIV_BL31) $(SECBOOT_KEYS_DIR)/$(notdir $(RSA_PRIV_BL31))
    cp -u $(RSA_PRIV_BL32) $(SECBOOT_KEYS_DIR)/$(notdir $(RSA_PRIV_BL32))
    cp -u $(RSA_PRIV_BL33) $(SECBOOT_KEYS_DIR)/$(notdir $(RSA_PRIV_BL33))
endef
ARM_TRUSTED_FIRMWARE_PRE_BUILD_HOOKS += ARM_TRUSTED_FIRMWARE_PREPARE_SECBOOT_BUILD

define ARM_TRUSTED_FIRMWARE_GENERATE_BL_PUB_KEYS
    openssl rsa -in $(RSA_PRIV_BL2) -pubout -out $(RSA_PUB_BL2)
    openssl rsa -in $(RSA_PRIV_BL31) -pubout -out $(RSA_PUB_BL31)
    @if [ $(OP_TEE) -eq 1 ]; then \
        openssl rsa -in $(RSA_PRIV_BL32) -pubout -out $(RSA_PUB_BL32); \
    fi
    openssl rsa -in $(RSA_PRIV_BL33) -pubout -out $(RSA_PUB_BL33)
endef
ARM_TRUSTED_FIRMWARE_PRE_BUILD_HOOKS += ARM_TRUSTED_FIRMWARE_GENERATE_BL_PUB_KEYS

ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
			SECBOOT_SUPPORT=1 \
			BL2_KEY=$(RSA_PRIV_BL2) \
			BL31_KEY=$(RSA_PRIV_BL31) \
			BL32_KEY=$(RSA_PRIV_BL32) \
			BL33_KEY=$(RSA_PRIV_BL33) \
			BL31_HSE_KEYHANDLE=$(BL31_HANDLE) \
			BL32_HSE_KEYHANDLE=$(BL32_HANDLE) \
			BL33_HSE_KEYHANDLE=$(BL33_HANDLE) \
			NXP_HSE_FWDIR=$(STAGING_DIR)/usr/include/hse-interface \
			MBEDTLS_DIR=$(STAGING_DIR)/usr/share/mbedtls-source

define ARM_TRUSTED_FIRMWARE_GENERATE_SECBOOT_SCRIPT
    echo '#!/bin/bash' > $(SECBOOT_SCRIPT)
    echo -n "hse-secboot -s -b \$$1 -d \$$2" >> $(SECBOOT_SCRIPT)
    echo -n " --bl2_key $(INSTALL_PATH_SECBOOT_KEYS)$(RSA_PUB_BL2_FILE):$(BL2_HANDLE)" >> $(SECBOOT_SCRIPT)
    echo -n " --bl31_key $(INSTALL_PATH_SECBOOT_KEYS)$(RSA_PUB_BL31_FILE):$(BL31_HANDLE)" >> $(SECBOOT_SCRIPT)
    @if [ "$(OP_TEE)" -eq 1 ]; then \
        echo -n " --bl32_key $(INSTALL_PATH_SECBOOT_KEYS)$(RSA_PUB_BL32_FILE):$(BL32_HANDLE)" >> $(SECBOOT_SCRIPT); \
    fi
    echo -n " --bl33_key $(INSTALL_PATH_SECBOOT_KEYS)$(RSA_PUB_BL33_FILE):$(BL33_HANDLE)" >> $(SECBOOT_SCRIPT)
    echo -n " --bl2_bin \$$3" >> $(SECBOOT_SCRIPT)
    echo " --bl2_sign \$$4" >> $(SECBOOT_SCRIPT)
    chmod +x $(SECBOOT_SCRIPT)
endef
ARM_TRUSTED_FIRMWARE_POST_BUILD_HOOKS += ARM_TRUSTED_FIRMWARE_GENERATE_SECBOOT_SCRIPT

define ARM_TRUSTED_FIRMWARE_INSTALL_SECBOOT_IMAGE
	install -d $(INSTALL_PATH_SECBOOT_KEYS)

    install -m 0666 $(BL2_SIGN) $(INSTALL_PATH_SECBOOT_KEYS)
    install -m 0666 $(BL2_BIN) $(INSTALL_PATH_SECBOOT_KEYS)

	install -m 0666 $(RSA_PUB_KEYS) $(INSTALL_PATH_SECBOOT_KEYS)
	if [ $(OP_TEE) -eq 1 ]; then \
		install -m 0666 $(RSA_PUB_BL32) $(INSTALL_PATH_SECBOOT_KEYS); \
	fi
	install -m 0777 $(SECBOOT_SCRIPT) $(INSTALL_PATH_SECBOOT_KEYS)
endef
ARM_TRUSTED_FIRMWARE_POST_INSTALL_TARGET_HOOKS += ARM_TRUSTED_FIRMWARE_INSTALL_SECBOOT_IMAGE
